To me it seems more reasonable to set the penalties at a level that’s high enough to deter violations. To make that calculation, the main inputs should be how much money they can make from the violation and how likely they are to get caught. Other profits the company made that weren’t from fraud are irrelevant. (or in this case, losses, since we are discussing an unprofitable company)